workos 0.19.0 → 0.20.2

package/dist/lib/config-store.d.ts

@@ -1,63 +0,0 @@
-/**
- * CLI config storage abstraction with keyring support and file fallback.
- *
- * Stores environment configurations (names, API keys, endpoints) separately
- * from OAuth credentials. Uses a second keyring entry under the same service.
- *
- * Storage priority:
- * 1. If insecure storage forced: use file only
- * 2. Try keyring, fall back to file with warning if unavailable
- */
-interface BaseEnvironmentConfig {
-    name: string;
-    apiKey: string;
-    endpoint?: string;
-    /** Email of the account that owns this environment. Stamped when `auth login` provisions Staging for a known account; undefined for unclaimed/manually-added envs. */
-    ownerEmail?: string;
-    /** User ID of the account that owns this environment. Stamped alongside ownerEmail. */
-    ownerUserId?: string;
-}
-export interface ClaimedEnvironmentConfig extends BaseEnvironmentConfig {
-    type: 'production' | 'sandbox';
-    clientId?: string;
-}
-export interface UnclaimedEnvironmentConfig extends BaseEnvironmentConfig {
-    type: 'unclaimed';
-    clientId: string;
-    claimToken: string;
-}
-export type EnvironmentConfig = ClaimedEnvironmentConfig | UnclaimedEnvironmentConfig;
-/**
- * Type guard — narrows to UnclaimedEnvironmentConfig with required clientId and claimToken.
- */
-export declare function isUnclaimedEnvironment(env: EnvironmentConfig): env is UnclaimedEnvironmentConfig;
-export interface CliConfig {
-    activeEnvironment?: string;
-    environments: Record<string, EnvironmentConfig>;
-}
-export declare function setInsecureConfigStorage(value: boolean): void;
-export declare function getConfig(): CliConfig | null;
-export declare function saveConfig(config: CliConfig): void;
-export declare function clearConfig(): void;
-export declare function getActiveEnvironment(): EnvironmentConfig | null;
-/**
- * Set the active environment by name.
- *
- * No-op when there is no config or the named environment does not exist —
- * callers should not be able to point `activeEnvironment` at a missing key.
- */
-export declare function setActiveEnvironment(name: string): void;
-/** Pick a non-colliding environments key: `base`, else `base-2`, `base-3`, … */
-export declare function freshEnvKey(config: CliConfig, base: string): string;
-export declare function getConfigPath(): string;
-/**
- * Diagnostic info about config storage state — for debugging config persistence failures.
- */
-export declare function diagnoseConfig(): string[];
-/**
- * Mark the active unclaimed environment as claimed.
- * Updates type to 'sandbox', removes the claim token, and renames
- * the environment key from 'unclaimed' to 'sandbox'.
- */
-export declare function markEnvironmentClaimed(): void;
-export {};

package/dist/lib/config-store.js

@@ -1,293 +0,0 @@
-/**
- * CLI config storage abstraction with keyring support and file fallback.
- *
- * Stores environment configurations (names, API keys, endpoints) separately
- * from OAuth credentials. Uses a second keyring entry under the same service.
- *
- * Storage priority:
- * 1. If insecure storage forced: use file only
- * 2. Try keyring, fall back to file with warning if unavailable
- */
-import { Entry } from '@napi-rs/keyring';
-import fs from 'node:fs';
-import path from 'node:path';
-import os from 'node:os';
-import { logWarn } from '../utils/debug.js';
-import { observeHostFailure } from './host-probe.js';
-/**
- * Type guard — narrows to UnclaimedEnvironmentConfig with required clientId and claimToken.
- */
-export function isUnclaimedEnvironment(env) {
-    return env.type === 'unclaimed';
-}
-const SERVICE_NAME = 'workos-cli';
-const ACCOUNT_NAME = 'config';
-let fallbackWarningShown = false;
-let forceInsecureStorage = false;
-let migrationAttempted = false;
-export function setInsecureConfigStorage(value) {
-    forceInsecureStorage = value;
-    migrationAttempted = false;
-}
-function getConfigDir() {
-    return path.join(os.homedir(), '.workos');
-}
-function getConfigFilePath() {
-    return path.join(getConfigDir(), 'config.json');
-}
-function fileExists() {
-    return fs.existsSync(getConfigFilePath());
-}
-function readFromFile() {
-    if (!fileExists())
-        return null;
-    const filePath = getConfigFilePath();
-    try {
-        const content = fs.readFileSync(filePath, 'utf-8');
-        return JSON.parse(content);
-    }
-    catch (error) {
-        observeHostFailure('home-fs', error, {
-            operation: 'read',
-            target: filePath,
-            label: 'config fallback file',
-        });
-        logWarn('Failed to read config file:', error);
-        return null;
-    }
-}
-function writeToFile(config) {
-    const dir = getConfigDir();
-    const filePath = getConfigFilePath();
-    try {
-        if (!fs.existsSync(dir)) {
-            fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-        }
-        fs.writeFileSync(filePath, JSON.stringify(config, null, 2), {
-            mode: 0o600,
-        });
-    }
-    catch (error) {
-        observeHostFailure('home-fs', error, {
-            operation: 'write',
-            target: filePath,
-            label: 'config fallback file',
-        });
-        throw error;
-    }
-}
-function deleteFile() {
-    const filePath = getConfigFilePath();
-    if (fileExists()) {
-        try {
-            fs.unlinkSync(filePath);
-        }
-        catch (error) {
-            observeHostFailure('home-fs', error, {
-                operation: 'delete',
-                target: filePath,
-                label: 'config fallback file',
-            });
-            throw error;
-        }
-    }
-}
-function getKeyringEntry() {
-    return new Entry(SERVICE_NAME, ACCOUNT_NAME);
-}
-function readFromKeyring() {
-    try {
-        const entry = getKeyringEntry();
-        const data = entry.getPassword();
-        if (!data)
-            return null;
-        return JSON.parse(data);
-    }
-    catch (error) {
-        logWarn('Failed to read config from keyring:', error);
-        observeHostFailure('keychain', error, {
-            operation: 'read',
-            target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,
-            label: 'config keychain entry',
-        });
-        return null;
-    }
-}
-function writeToKeyring(config) {
-    try {
-        const entry = getKeyringEntry();
-        entry.setPassword(JSON.stringify(config));
-        return true;
-    }
-    catch (error) {
-        logWarn('Failed to write config to keyring:', error);
-        observeHostFailure('keychain', error, {
-            operation: 'write',
-            target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,
-            label: 'config keychain entry',
-        });
-        return false;
-    }
-}
-function deleteFromKeyring() {
-    try {
-        const entry = getKeyringEntry();
-        entry.deletePassword();
-    }
-    catch (error) {
-        const msg = error instanceof Error ? error.message : String(error);
-        if (!msg.includes('not found') && !msg.includes('No such')) {
-            logWarn('Failed to delete config from keyring:', error);
-            observeHostFailure('keychain', error, {
-                operation: 'delete',
-                target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,
-                label: 'config keychain entry',
-            });
-        }
-    }
-}
-function showFallbackWarning() {
-    if (fallbackWarningShown || forceInsecureStorage)
-        return;
-    fallbackWarningShown = true;
-    logWarn('Unable to store config in system keyring. Using file storage.', 'Config saved to ~/.workos/config.json', 'Use --insecure-storage to suppress this warning.');
-}
-export function getConfig() {
-    if (forceInsecureStorage)
-        return readFromFile();
-    const keyringConfig = readFromKeyring();
-    if (keyringConfig)
-        return keyringConfig;
-    const fileConfig = readFromFile();
-    if (fileConfig) {
-        if (!migrationAttempted) {
-            migrationAttempted = true;
-            writeToKeyring(fileConfig);
-        }
-        return fileConfig;
-    }
-    return null;
-}
-export function saveConfig(config) {
-    if (forceInsecureStorage)
-        return writeToFile(config);
-    if (!writeToKeyring(config)) {
-        showFallbackWarning();
-        writeToFile(config);
-        return;
-    }
-    // Verify the keyring write is readable (guards against silent keyring failures
-    // where setPassword succeeds but getPassword returns null in the same process)
-    if (!readFromKeyring()) {
-        logWarn('Keyring write succeeded but read-back failed — falling back to file');
-        writeToFile(config);
-    }
-}
-export function clearConfig() {
-    deleteFromKeyring();
-    deleteFile();
-    migrationAttempted = false;
-}
-export function getActiveEnvironment() {
-    const config = getConfig();
-    if (!config?.activeEnvironment)
-        return null;
-    return config.environments[config.activeEnvironment] ?? null;
-}
-/**
- * Set the active environment by name.
- *
- * No-op when there is no config or the named environment does not exist —
- * callers should not be able to point `activeEnvironment` at a missing key.
- */
-export function setActiveEnvironment(name) {
-    const config = getConfig();
-    if (!config || !config.environments[name])
-        return;
-    config.activeEnvironment = name;
-    saveConfig(config);
-}
-/** Pick a non-colliding environments key: `base`, else `base-2`, `base-3`, … */
-export function freshEnvKey(config, base) {
-    if (!config.environments[base])
-        return base;
-    let i = 2;
-    while (config.environments[`${base}-${i}`])
-        i++;
-    return `${base}-${i}`;
-}
-export function getConfigPath() {
-    return getConfigFilePath();
-}
-/**
- * Diagnostic info about config storage state — for debugging config persistence failures.
- */
-export function diagnoseConfig() {
-    const lines = [];
-    const filePath = getConfigFilePath();
-    const filePresent = fileExists();
-    lines.push(`file: ${filePath} (exists=${filePresent})`);
-    if (filePresent) {
-        try {
-            const content = fs.readFileSync(filePath, 'utf-8');
-            const parsed = JSON.parse(content);
-            const envCount = parsed.environments ? Object.keys(parsed.environments).length : 0;
-            lines.push(`file config: active=${parsed.activeEnvironment ?? 'none'}, environments=${envCount}`);
-        }
-        catch (e) {
-            lines.push(`file config: parse error — ${e instanceof Error ? e.message : String(e)}`);
-        }
-    }
-    try {
-        const entry = getKeyringEntry();
-        const data = entry.getPassword();
-        if (data) {
-            const parsed = JSON.parse(data);
-            const envCount = parsed.environments ? Object.keys(parsed.environments).length : 0;
-            lines.push(`keyring: found, active=${parsed.activeEnvironment ?? 'none'}, environments=${envCount}`);
-        }
-        else {
-            lines.push('keyring: empty (getPassword returned null)');
-        }
-    }
-    catch (e) {
-        lines.push(`keyring: error — ${e instanceof Error ? e.message : String(e)}`);
-    }
-    lines.push(`insecureStorage=${forceInsecureStorage}`);
-    return lines;
-}
-/**
- * Mark the active unclaimed environment as claimed.
- * Updates type to 'sandbox', removes the claim token, and renames
- * the environment key from 'unclaimed' to 'sandbox'.
- */
-export function markEnvironmentClaimed() {
-    const config = getConfig();
-    if (!config?.activeEnvironment)
-        return;
-    const oldKey = config.activeEnvironment;
-    const env = config.environments[oldKey];
-    if (env && env.type === 'unclaimed') {
-        // Pick a key that won't overwrite an existing environment
-        let newKey = 'sandbox';
-        if (oldKey !== newKey && config.environments[newKey]) {
-            newKey = oldKey; // keep existing key if 'sandbox' is already taken
-        }
-        const claimed = {
-            name: newKey,
-            type: 'sandbox',
-            apiKey: env.apiKey,
-            clientId: env.clientId,
-            ...(env.endpoint && { endpoint: env.endpoint }),
-            ...(env.ownerEmail && { ownerEmail: env.ownerEmail }),
-            ...(env.ownerUserId && { ownerUserId: env.ownerUserId }),
-        };
-        if (oldKey !== newKey) {
-            delete config.environments[oldKey];
-        }
-        config.environments[newKey] = claimed;
-        config.activeEnvironment = newKey;
-        saveConfig(config);
-    }
-}
-//# sourceMappingURL=config-store.js.map

package/dist/lib/config-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../../src/lib/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAyBrD;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAsB;IAC3D,OAAO,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC;AAClC,CAAC;AAOD,MAAM,YAAY,GAAG,YAAY,CAAC;AAClC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAE9B,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,IAAI,kBAAkB,GAAG,KAAK,CAAC;AAE/B,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,oBAAoB,GAAG,KAAK,CAAC;IAC7B,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,EAAE,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;YACnC,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,sBAAsB;SAC9B,CAAC,CAAC;QACH,OAAO,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAiB;IACpC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YAC1D,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;YACnC,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,sBAAsB;SAC9B,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;gBACnC,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,sBAAsB;aAC9B,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;QACtD,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;YACpC,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;YACzC,KAAK,EAAE,uBAAuB;SAC/B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAiB;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QACrD,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;YACpC,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;YACzC,KAAK,EAAE,uBAAuB;SAC/B,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,cAAc,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;YACxD,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;gBACpC,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;gBACzC,KAAK,EAAE,uBAAuB;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,IAAI,oBAAoB,IAAI,oBAAoB;QAAE,OAAO;IACzD,oBAAoB,GAAG,IAAI,CAAC;IAC5B,OAAO,CACL,+DAA+D,EAC/D,uCAAuC,EACvC,kDAAkD,CACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,oBAAoB;QAAE,OAAO,YAAY,EAAE,CAAC;IAEhD,MAAM,aAAa,GAAG,eAAe,EAAE,CAAC;IACxC,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,UAAU,GAAG,YAAY,EAAE,CAAC;IAClC,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,kBAAkB,GAAG,IAAI,CAAC;YAC1B,cAAc,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAiB;IAC1C,IAAI,oBAAoB;QAAE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAErD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,mBAAmB,EAAE,CAAC;QACtB,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,+EAA+E;IAC/E,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QACvB,OAAO,CAAC,qEAAqE,CAAC,CAAC;QAC/E,WAAW,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,iBAAiB,EAAE,CAAC;IACpB,UAAU,EAAE,CAAC;IACb,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,EAAE,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO;IAClD,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAChC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,WAAW,CAAC,MAAiB,EAAE,IAAY;IACzD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAAE,CAAC,EAAE,CAAC;IAChD,OAAO,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;IAEjC,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,YAAY,WAAW,GAAG,CAAC,CAAC;IAExD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAuB,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,KAAK,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,iBAAiB,IAAI,MAAM,kBAAkB,QAAQ,EAAE,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;YACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,KAAK,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,iBAAiB,IAAI,MAAM,kBAAkB,QAAQ,EAAE,CAAC,CAAC;QACvG,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,mBAAmB,oBAAoB,EAAE,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,EAAE,iBAAiB;QAAE,OAAO;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACpC,0DAA0D;QAC1D,IAAI,MAAM,GAAG,SAAS,CAAC;QACvB,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,MAAM,GAAG,MAAM,CAAC,CAAC,kDAAkD;QACrE,CAAC;QAED,MAAM,OAAO,GAA6B;YACxC,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC/C,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;SACzD,CAAC;QAEF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;QACtC,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QAElC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;AACH,CAAC","sourcesContent":["/**\n * CLI config storage abstraction with keyring support and file fallback.\n *\n * Stores environment configurations (names, API keys, endpoints) separately\n * from OAuth credentials. Uses a second keyring entry under the same service.\n *\n * Storage priority:\n * 1. If insecure storage forced: use file only\n * 2. Try keyring, fall back to file with warning if unavailable\n */\n\nimport { Entry } from '@napi-rs/keyring';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport os from 'node:os';\nimport { logWarn } from '../utils/debug.js';\nimport { observeHostFailure } from './host-probe.js';\n\ninterface BaseEnvironmentConfig {\n  name: string;\n  apiKey: string;\n  endpoint?: string;\n  /** Email of the account that owns this environment. Stamped when `auth login` provisions Staging for a known account; undefined for unclaimed/manually-added envs. */\n  ownerEmail?: string;\n  /** User ID of the account that owns this environment. Stamped alongside ownerEmail. */\n  ownerUserId?: string;\n}\n\nexport interface ClaimedEnvironmentConfig extends BaseEnvironmentConfig {\n  type: 'production' | 'sandbox';\n  clientId?: string;\n}\n\nexport interface UnclaimedEnvironmentConfig extends BaseEnvironmentConfig {\n  type: 'unclaimed';\n  clientId: string;\n  claimToken: string;\n}\n\nexport type EnvironmentConfig = ClaimedEnvironmentConfig | UnclaimedEnvironmentConfig;\n\n/**\n * Type guard — narrows to UnclaimedEnvironmentConfig with required clientId and claimToken.\n */\nexport function isUnclaimedEnvironment(env: EnvironmentConfig): env is UnclaimedEnvironmentConfig {\n  return env.type === 'unclaimed';\n}\n\nexport interface CliConfig {\n  activeEnvironment?: string;\n  environments: Record<string, EnvironmentConfig>;\n}\n\nconst SERVICE_NAME = 'workos-cli';\nconst ACCOUNT_NAME = 'config';\n\nlet fallbackWarningShown = false;\nlet forceInsecureStorage = false;\nlet migrationAttempted = false;\n\nexport function setInsecureConfigStorage(value: boolean): void {\n  forceInsecureStorage = value;\n  migrationAttempted = false;\n}\n\nfunction getConfigDir(): string {\n  return path.join(os.homedir(), '.workos');\n}\n\nfunction getConfigFilePath(): string {\n  return path.join(getConfigDir(), 'config.json');\n}\n\nfunction fileExists(): boolean {\n  return fs.existsSync(getConfigFilePath());\n}\n\nfunction readFromFile(): CliConfig | null {\n  if (!fileExists()) return null;\n  const filePath = getConfigFilePath();\n  try {\n    const content = fs.readFileSync(filePath, 'utf-8');\n    return JSON.parse(content);\n  } catch (error) {\n    observeHostFailure('home-fs', error, {\n      operation: 'read',\n      target: filePath,\n      label: 'config fallback file',\n    });\n    logWarn('Failed to read config file:', error);\n    return null;\n  }\n}\n\nfunction writeToFile(config: CliConfig): void {\n  const dir = getConfigDir();\n  const filePath = getConfigFilePath();\n  try {\n    if (!fs.existsSync(dir)) {\n      fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n    }\n    fs.writeFileSync(filePath, JSON.stringify(config, null, 2), {\n      mode: 0o600,\n    });\n  } catch (error) {\n    observeHostFailure('home-fs', error, {\n      operation: 'write',\n      target: filePath,\n      label: 'config fallback file',\n    });\n    throw error;\n  }\n}\n\nfunction deleteFile(): void {\n  const filePath = getConfigFilePath();\n  if (fileExists()) {\n    try {\n      fs.unlinkSync(filePath);\n    } catch (error) {\n      observeHostFailure('home-fs', error, {\n        operation: 'delete',\n        target: filePath,\n        label: 'config fallback file',\n      });\n      throw error;\n    }\n  }\n}\n\nfunction getKeyringEntry(): Entry {\n  return new Entry(SERVICE_NAME, ACCOUNT_NAME);\n}\n\nfunction readFromKeyring(): CliConfig | null {\n  try {\n    const entry = getKeyringEntry();\n    const data = entry.getPassword();\n    if (!data) return null;\n    return JSON.parse(data);\n  } catch (error) {\n    logWarn('Failed to read config from keyring:', error);\n    observeHostFailure('keychain', error, {\n      operation: 'read',\n      target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n      label: 'config keychain entry',\n    });\n    return null;\n  }\n}\n\nfunction writeToKeyring(config: CliConfig): boolean {\n  try {\n    const entry = getKeyringEntry();\n    entry.setPassword(JSON.stringify(config));\n    return true;\n  } catch (error) {\n    logWarn('Failed to write config to keyring:', error);\n    observeHostFailure('keychain', error, {\n      operation: 'write',\n      target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n      label: 'config keychain entry',\n    });\n    return false;\n  }\n}\n\nfunction deleteFromKeyring(): void {\n  try {\n    const entry = getKeyringEntry();\n    entry.deletePassword();\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    if (!msg.includes('not found') && !msg.includes('No such')) {\n      logWarn('Failed to delete config from keyring:', error);\n      observeHostFailure('keychain', error, {\n        operation: 'delete',\n        target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n        label: 'config keychain entry',\n      });\n    }\n  }\n}\n\nfunction showFallbackWarning(): void {\n  if (fallbackWarningShown || forceInsecureStorage) return;\n  fallbackWarningShown = true;\n  logWarn(\n    'Unable to store config in system keyring. Using file storage.',\n    'Config saved to ~/.workos/config.json',\n    'Use --insecure-storage to suppress this warning.',\n  );\n}\n\nexport function getConfig(): CliConfig | null {\n  if (forceInsecureStorage) return readFromFile();\n\n  const keyringConfig = readFromKeyring();\n  if (keyringConfig) return keyringConfig;\n\n  const fileConfig = readFromFile();\n  if (fileConfig) {\n    if (!migrationAttempted) {\n      migrationAttempted = true;\n      writeToKeyring(fileConfig);\n    }\n    return fileConfig;\n  }\n\n  return null;\n}\n\nexport function saveConfig(config: CliConfig): void {\n  if (forceInsecureStorage) return writeToFile(config);\n\n  if (!writeToKeyring(config)) {\n    showFallbackWarning();\n    writeToFile(config);\n    return;\n  }\n\n  // Verify the keyring write is readable (guards against silent keyring failures\n  // where setPassword succeeds but getPassword returns null in the same process)\n  if (!readFromKeyring()) {\n    logWarn('Keyring write succeeded but read-back failed — falling back to file');\n    writeToFile(config);\n  }\n}\n\nexport function clearConfig(): void {\n  deleteFromKeyring();\n  deleteFile();\n  migrationAttempted = false;\n}\n\nexport function getActiveEnvironment(): EnvironmentConfig | null {\n  const config = getConfig();\n  if (!config?.activeEnvironment) return null;\n  return config.environments[config.activeEnvironment] ?? null;\n}\n\n/**\n * Set the active environment by name.\n *\n * No-op when there is no config or the named environment does not exist —\n * callers should not be able to point `activeEnvironment` at a missing key.\n */\nexport function setActiveEnvironment(name: string): void {\n  const config = getConfig();\n  if (!config || !config.environments[name]) return;\n  config.activeEnvironment = name;\n  saveConfig(config);\n}\n\n/** Pick a non-colliding environments key: `base`, else `base-2`, `base-3`, … */\nexport function freshEnvKey(config: CliConfig, base: string): string {\n  if (!config.environments[base]) return base;\n  let i = 2;\n  while (config.environments[`${base}-${i}`]) i++;\n  return `${base}-${i}`;\n}\n\nexport function getConfigPath(): string {\n  return getConfigFilePath();\n}\n\n/**\n * Diagnostic info about config storage state — for debugging config persistence failures.\n */\nexport function diagnoseConfig(): string[] {\n  const lines: string[] = [];\n  const filePath = getConfigFilePath();\n  const filePresent = fileExists();\n\n  lines.push(`file: ${filePath} (exists=${filePresent})`);\n\n  if (filePresent) {\n    try {\n      const content = fs.readFileSync(filePath, 'utf-8');\n      const parsed = JSON.parse(content) as Partial<CliConfig>;\n      const envCount = parsed.environments ? Object.keys(parsed.environments).length : 0;\n      lines.push(`file config: active=${parsed.activeEnvironment ?? 'none'}, environments=${envCount}`);\n    } catch (e) {\n      lines.push(`file config: parse error — ${e instanceof Error ? e.message : String(e)}`);\n    }\n  }\n\n  try {\n    const entry = getKeyringEntry();\n    const data = entry.getPassword();\n    if (data) {\n      const parsed = JSON.parse(data) as Partial<CliConfig>;\n      const envCount = parsed.environments ? Object.keys(parsed.environments).length : 0;\n      lines.push(`keyring: found, active=${parsed.activeEnvironment ?? 'none'}, environments=${envCount}`);\n    } else {\n      lines.push('keyring: empty (getPassword returned null)');\n    }\n  } catch (e) {\n    lines.push(`keyring: error — ${e instanceof Error ? e.message : String(e)}`);\n  }\n\n  lines.push(`insecureStorage=${forceInsecureStorage}`);\n  return lines;\n}\n\n/**\n * Mark the active unclaimed environment as claimed.\n * Updates type to 'sandbox', removes the claim token, and renames\n * the environment key from 'unclaimed' to 'sandbox'.\n */\nexport function markEnvironmentClaimed(): void {\n  const config = getConfig();\n  if (!config?.activeEnvironment) return;\n  const oldKey = config.activeEnvironment;\n  const env = config.environments[oldKey];\n  if (env && env.type === 'unclaimed') {\n    // Pick a key that won't overwrite an existing environment\n    let newKey = 'sandbox';\n    if (oldKey !== newKey && config.environments[newKey]) {\n      newKey = oldKey; // keep existing key if 'sandbox' is already taken\n    }\n\n    const claimed: ClaimedEnvironmentConfig = {\n      name: newKey,\n      type: 'sandbox',\n      apiKey: env.apiKey,\n      clientId: env.clientId,\n      ...(env.endpoint && { endpoint: env.endpoint }),\n      ...(env.ownerEmail && { ownerEmail: env.ownerEmail }),\n      ...(env.ownerUserId && { ownerUserId: env.ownerUserId }),\n    };\n\n    if (oldKey !== newKey) {\n      delete config.environments[oldKey];\n    }\n    config.environments[newKey] = claimed;\n    config.activeEnvironment = newKey;\n\n    saveConfig(config);\n  }\n}\n"]}

package/dist/lib/config.d.ts

@@ -1,34 +0,0 @@
-/**
- * Integration detection configuration.
- *
- * This module previously held hardcoded INTEGRATION_CONFIG and INTEGRATION_ORDER.
- * These are now provided by the auto-discovery registry (src/lib/registry.ts).
- *
- * This file is kept for backwards compatibility — functions that previously
- * used INTEGRATION_CONFIG now delegate to the registry.
- */
-import type { InstallerOptions } from '../utils/types.js';
-/**
- * @deprecated Use registry.detectionOrder() + config.detection.detect() instead.
- * This type is kept for any code that still references it.
- */
-export type IntegrationConfig = {
-    name: string;
-    filterPatterns: string[];
-    ignorePatterns: string[];
-    detect: (options: Pick<InstallerOptions, 'installDir'>) => Promise<boolean>;
-    generateFilesRules: string;
-    filterFilesRules: string;
-    docsUrl: string;
-    nextSteps: string;
-    defaultChanges: string;
-};
-/**
- * Legacy detection configs for existing JS integrations.
- * Used by ui-utils.ts for abort/cancel messages.
- * New integrations do NOT need to be added here.
- */
-export declare const INTEGRATION_CONFIG: Record<string, {
-    docsUrl: string;
-    name: string;
-}>;

package/dist/lib/config.js

@@ -1,37 +0,0 @@
-/**
- * Integration detection configuration.
- *
- * This module previously held hardcoded INTEGRATION_CONFIG and INTEGRATION_ORDER.
- * These are now provided by the auto-discovery registry (src/lib/registry.ts).
- *
- * This file is kept for backwards compatibility — functions that previously
- * used INTEGRATION_CONFIG now delegate to the registry.
- */
-/**
- * Legacy detection configs for existing JS integrations.
- * Used by ui-utils.ts for abort/cancel messages.
- * New integrations do NOT need to be added here.
- */
-export const INTEGRATION_CONFIG = {
-    nextjs: {
-        name: 'Next.js',
-        docsUrl: 'https://workos.com/docs/user-management/authkit/nextjs',
-    },
-    react: {
-        name: 'React (SPA)',
-        docsUrl: 'https://workos.com/docs/user-management/authkit/react',
-    },
-    'tanstack-start': {
-        name: 'TanStack Start',
-        docsUrl: 'https://workos.com/docs/user-management/authkit/tanstack-start',
-    },
-    'react-router': {
-        name: 'React Router',
-        docsUrl: 'https://workos.com/docs/user-management/authkit/react-router',
-    },
-    'vanilla-js': {
-        name: 'Vanilla JavaScript',
-        docsUrl: 'https://workos.com/docs/user-management/authkit/javascript',
-    },
-};
-//# sourceMappingURL=config.js.map

package/dist/lib/config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAoBH;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsD;IACnF,MAAM,EAAE;QACN,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,wDAAwD;KAClE;IACD,KAAK,EAAE;QACL,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,uDAAuD;KACjE;IACD,gBAAgB,EAAE;QAChB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,gEAAgE;KAC1E;IACD,cAAc,EAAE;QACd,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,8DAA8D;KACxE;IACD,YAAY,EAAE;QACZ,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,4DAA4D;KACtE;CACF,CAAC","sourcesContent":["/**\n * Integration detection configuration.\n *\n * This module previously held hardcoded INTEGRATION_CONFIG and INTEGRATION_ORDER.\n * These are now provided by the auto-discovery registry (src/lib/registry.ts).\n *\n * This file is kept for backwards compatibility — functions that previously\n * used INTEGRATION_CONFIG now delegate to the registry.\n */\n\nimport type { InstallerOptions } from '../utils/types.js';\n\n/**\n * @deprecated Use registry.detectionOrder() + config.detection.detect() instead.\n * This type is kept for any code that still references it.\n */\nexport type IntegrationConfig = {\n  name: string;\n  filterPatterns: string[];\n  ignorePatterns: string[];\n  detect: (options: Pick<InstallerOptions, 'installDir'>) => Promise<boolean>;\n  generateFilesRules: string;\n  filterFilesRules: string;\n  docsUrl: string;\n  nextSteps: string;\n  defaultChanges: string;\n};\n\n/**\n * Legacy detection configs for existing JS integrations.\n * Used by ui-utils.ts for abort/cancel messages.\n * New integrations do NOT need to be added here.\n */\nexport const INTEGRATION_CONFIG: Record<string, { docsUrl: string; name: string }> = {\n  nextjs: {\n    name: 'Next.js',\n    docsUrl: 'https://workos.com/docs/user-management/authkit/nextjs',\n  },\n  react: {\n    name: 'React (SPA)',\n    docsUrl: 'https://workos.com/docs/user-management/authkit/react',\n  },\n  'tanstack-start': {\n    name: 'TanStack Start',\n    docsUrl: 'https://workos.com/docs/user-management/authkit/tanstack-start',\n  },\n  'react-router': {\n    name: 'React Router',\n    docsUrl: 'https://workos.com/docs/user-management/authkit/react-router',\n  },\n  'vanilla-js': {\n    name: 'Vanilla JavaScript',\n    docsUrl: 'https://workos.com/docs/user-management/authkit/javascript',\n  },\n};\n"]}

package/dist/lib/constants.d.ts

@@ -1,51 +0,0 @@
-/**
- * Integration identifier type.
- * No longer an enum — each integration self-registers via the auto-discovery registry.
- * The string value matches the integration directory name (e.g., 'nextjs', 'react-router').
- */
-export type Integration = string;
-/**
- * Well-known integration names for backwards compatibility.
- * New integrations do NOT need to be added here — they're auto-discovered.
- */
-export declare const KNOWN_INTEGRATIONS: {
-    readonly nextjs: "nextjs";
-    readonly react: "react";
-    readonly tanstackStart: "tanstack-start";
-    readonly reactRouter: "react-router";
-    readonly vanillaJs: "vanilla-js";
-};
-export interface Args {
-    debug: boolean;
-    integration: Integration;
-}
-export declare const IS_DEV: boolean;
-export declare const DEBUG: boolean;
-export declare const WORKOS_DOCS_URL: string;
-export declare const WORKOS_DASHBOARD_URL: string;
-export declare const ISSUES_URL: string;
-export declare const ANALYTICS_ENABLED: boolean;
-export declare const INSTALLER_INTERACTION_EVENT_NAME: string;
-export declare const OAUTH_PORT: number;
-/**
- * WorkOS MCP server identity, shared by the `mcp` command group and the
- * per-client writers in `lib/mcp-clients.ts`.
- *
- * The server is secret-free: HTTP transport with OAuth handled by each client
- * on first connect, so configuring it never requires CLI auth.
- */
-export declare const MCP_SERVER_NAME = "workos";
-export declare const MCP_SERVER_URL = "https://mcp.workos.com/mcp";
-/**
- * Shared description for the `migrations` command, referenced by both the yargs
- * registration (`bin.ts`) and the JSON help registry (`help-json.ts`) so the two
- * surfaces cannot drift. Advertises the generic-CSV path (e.g. Supabase) without
- * implying a dedicated exporter exists for it. Hand-maintained — not derived from
- * `@workos/migrations`.
- */
-export declare const MIGRATIONS_DESCRIPTION = "Migrate users to WorkOS from Auth0, Cognito, Clerk, Firebase, or any provider via CSV (e.g. Supabase)";
-/**
- * Common glob patterns to ignore when searching for files.
- * Used by multiple integrations.
- */
-export declare const IGNORE_PATTERNS: string[];

package/dist/lib/constants.js

@@ -1,50 +0,0 @@
-import { getConfig } from './settings.js';
-/**
- * Well-known integration names for backwards compatibility.
- * New integrations do NOT need to be added here — they're auto-discovered.
- */
-export const KNOWN_INTEGRATIONS = {
-    nextjs: 'nextjs',
-    react: 'react',
-    tanstackStart: 'tanstack-start',
-    reactRouter: 'react-router',
-    vanillaJs: 'vanilla-js',
-};
-export const IS_DEV = ['test', 'development'].includes(process.env.NODE_ENV ?? '');
-const settings = getConfig();
-export const DEBUG = settings.logging.debugMode;
-export const WORKOS_DOCS_URL = settings.documentation.workosDocsUrl;
-export const WORKOS_DASHBOARD_URL = settings.documentation.dashboardUrl;
-export const ISSUES_URL = settings.documentation.issuesUrl;
-export const ANALYTICS_ENABLED = settings.telemetry.enabled;
-export const INSTALLER_INTERACTION_EVENT_NAME = settings.telemetry.eventName;
-export const OAUTH_PORT = settings.legacy.oauthPort;
-/**
- * WorkOS MCP server identity, shared by the `mcp` command group and the
- * per-client writers in `lib/mcp-clients.ts`.
- *
- * The server is secret-free: HTTP transport with OAuth handled by each client
- * on first connect, so configuring it never requires CLI auth.
- */
-export const MCP_SERVER_NAME = 'workos';
-export const MCP_SERVER_URL = 'https://mcp.workos.com/mcp';
-/**
- * Shared description for the `migrations` command, referenced by both the yargs
- * registration (`bin.ts`) and the JSON help registry (`help-json.ts`) so the two
- * surfaces cannot drift. Advertises the generic-CSV path (e.g. Supabase) without
- * implying a dedicated exporter exists for it. Hand-maintained — not derived from
- * `@workos/migrations`.
- */
-export const MIGRATIONS_DESCRIPTION = 'Migrate users to WorkOS from Auth0, Cognito, Clerk, Firebase, or any provider via CSV (e.g. Supabase)';
-/**
- * Common glob patterns to ignore when searching for files.
- * Used by multiple integrations.
- */
-export const IGNORE_PATTERNS = [
-    '**/node_modules/**',
-    '**/dist/**',
-    '**/build/**',
-    '**/public/**',
-    '**/.next/**',
-];
-//# sourceMappingURL=constants.js.map

package/dist/lib/constants.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/lib/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAS1C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,aAAa,EAAE,gBAAgB;IAC/B,WAAW,EAAE,cAAc;IAC3B,SAAS,EAAE,YAAY;CACf,CAAC;AAOX,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;AAEnF,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;AAChD,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,aAAa,CAAC;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC,aAAa,CAAC,YAAY,CAAC;AACxE,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC;AAC5D,MAAM,CAAC,MAAM,gCAAgC,GAAG,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;AAC7E,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,4BAA4B,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,uGAAuG,CAAC;AAE1G;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,oBAAoB;IACpB,YAAY;IACZ,aAAa;IACb,cAAc;IACd,aAAa;CACd,CAAC","sourcesContent":["import { getConfig } from './settings.js';\n\n/**\n * Integration identifier type.\n * No longer an enum — each integration self-registers via the auto-discovery registry.\n * The string value matches the integration directory name (e.g., 'nextjs', 'react-router').\n */\nexport type Integration = string;\n\n/**\n * Well-known integration names for backwards compatibility.\n * New integrations do NOT need to be added here — they're auto-discovered.\n */\nexport const KNOWN_INTEGRATIONS = {\n  nextjs: 'nextjs',\n  react: 'react',\n  tanstackStart: 'tanstack-start',\n  reactRouter: 'react-router',\n  vanillaJs: 'vanilla-js',\n} as const;\n\nexport interface Args {\n  debug: boolean;\n  integration: Integration;\n}\n\nexport const IS_DEV = ['test', 'development'].includes(process.env.NODE_ENV ?? '');\n\nconst settings = getConfig();\n\nexport const DEBUG = settings.logging.debugMode;\nexport const WORKOS_DOCS_URL = settings.documentation.workosDocsUrl;\nexport const WORKOS_DASHBOARD_URL = settings.documentation.dashboardUrl;\nexport const ISSUES_URL = settings.documentation.issuesUrl;\nexport const ANALYTICS_ENABLED = settings.telemetry.enabled;\nexport const INSTALLER_INTERACTION_EVENT_NAME = settings.telemetry.eventName;\nexport const OAUTH_PORT = settings.legacy.oauthPort;\n\n/**\n * WorkOS MCP server identity, shared by the `mcp` command group and the\n * per-client writers in `lib/mcp-clients.ts`.\n *\n * The server is secret-free: HTTP transport with OAuth handled by each client\n * on first connect, so configuring it never requires CLI auth.\n */\nexport const MCP_SERVER_NAME = 'workos';\nexport const MCP_SERVER_URL = 'https://mcp.workos.com/mcp';\n\n/**\n * Shared description for the `migrations` command, referenced by both the yargs\n * registration (`bin.ts`) and the JSON help registry (`help-json.ts`) so the two\n * surfaces cannot drift. Advertises the generic-CSV path (e.g. Supabase) without\n * implying a dedicated exporter exists for it. Hand-maintained — not derived from\n * `@workos/migrations`.\n */\nexport const MIGRATIONS_DESCRIPTION =\n  'Migrate users to WorkOS from Auth0, Cognito, Clerk, Firebase, or any provider via CSV (e.g. Supabase)';\n\n/**\n * Common glob patterns to ignore when searching for files.\n * Used by multiple integrations.\n */\nexport const IGNORE_PATTERNS: string[] = [\n  '**/node_modules/**',\n  '**/dist/**',\n  '**/build/**',\n  '**/public/**',\n  '**/.next/**',\n];\n"]}

package/dist/lib/credential-discovery.d.ts

@@ -1,42 +0,0 @@
-export interface DiscoveryResult {
-    found: boolean;
-    source?: 'env' | 'declined';
-    clientId?: string;
-    apiKey?: string;
-    sourcePath?: string;
-}
-export interface EnvFileInfo {
-    exists: boolean;
-    files: string[];
-}
-/**
- * Check if env files exist in the project directory (without reading contents).
- * Returns which files were found so the UI can prompt for consent.
- */
-export declare function checkForEnvFiles(projectDir: string): Promise<EnvFileInfo>;
-/**
- * Scan a single env file for WorkOS credentials.
- * Only extracts WORKOS_CLIENT_ID and WORKOS_API_KEY - ignores all other variables.
- */
-export declare function scanEnvFile(filePath: string): Promise<{
-    clientId?: string;
-    apiKey?: string;
-}>;
-/**
- * Validate client ID format.
- * WorkOS client IDs start with 'client_' prefix.
- */
-export declare function isValidClientId(value: string): boolean;
-/**
- * Validate API key format.
- * WorkOS secret keys start with 'sk_' prefix.
- */
-export declare function isValidApiKey(value: string): boolean;
-/**
- * Discover WorkOS credentials from project env files.
- * Must be called AFTER user consent is given.
- *
- * Scans files in priority order: .env.local > .env.development.local > .env.development > .env
- * Returns first complete match (both clientId and apiKey preferred, but clientId-only is valid).
- */
-export declare function discoverCredentials(projectDir: string): Promise<DiscoveryResult>;